CVE-2026-20518: CWE-125 Out-of-bounds Read in MediaTek, Inc. MediaTek chipset

This vulnerability involves an out-of-bounds read in the geniezone component of MediaTek chipsets due to a missing bounds check. It may lead to local information disclosure if a malicious actor has obtained System privilege. Exploitation requires user interaction. The affected products include specific MediaTek chipset models such as MT6991, MT8755, MT8768, MT8771, MT8775, MT8781, MT8792, MT8793, MT8796, MT8797, MT8798, MT8799, MT8873, MT8883, MT8893, and MT8910. No CVSS score or vendor advisory detailing remediation or patch availability is provided at this time.

The impact is limited to local information disclosure, requiring the attacker to have System privilege and user interaction. There is no indication of remote exploitation or privilege escalation from the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor MediaTek advisories for updates. Exploitation requires System privilege and user interaction, which limits the risk to already compromised environments.